DECREE NO. 58/2021/NĐ-CP REGULATING THE ACTIVITY OF SUPPLYING CREDIT INFORMATION SERVICES

 

DECREE

REGULATIONS ON THE ACTIVITIES OF PROVIDING CREDIT INFORMATION SERVICES

Pursuant to the Law on Organization of the Government dated June 19, 2015; the Law Amending and Supplementing Certain Provisions of the Law on Organization of the Government and the Law on Organization of Local Administration dated November 22, 2019;

Pursuant to the Law on the State Bank of Vietnam dated June 16, 2010;

Pursuant to the Law on Credit Institutions dated June 16, 2010; the Law Amending and Supplementing Certain Articles of the Law on Credit Institutions dated November 20, 2017;

Pursuant to the Law on Enterprises dated June 17, 2020;

Pursuant to the Investment Law dated June 17, 2020;

At the proposal of the Governor of the State Bank of Vietnam;

The Government promulgates this Decree on the activities of providing credit information services.

PART I
GENERAL PROVISIONS

Article 1. Scope of Regulation

1. This Decree stipulates conditions, procedures for issuing, reissuing, changing contents, and revoking the Certificate of Eligibility for Providing Credit Information Services (hereinafter referred to as the Certificate); the activities of providing credit information services by credit information companies and the rights and obligations of related organizations and individuals.

2. The credit information activities of the State Bank of Vietnam (hereinafter referred to as the State Bank) are not within the scope of regulation of this Decree.

Article 2. Applicability

1. Credit information company.

2. Participating organization.

3. Borrower.

4. Other related organizations and individuals.

Article 3. Explanation of Terms

In this Decree, the following terms are understood as follows:

1. Credit information is data, figures, facts related to borrowers at participating organizations of credit information companies.

2. The activity of providing credit information services is the provision by credit information companies of credit information products to users based on their activities of collecting, processing, storing credit information according to the provisions of this Decree.

3. Participating organization of a credit information company (hereinafter referred to as the participating organization) is an organization voluntarily committing to provide credit information to credit information companies, including: credit institutions, foreign bank branches; non-credit institutions, foreign bank branches providing leasing services, deferred payment purchases, installment purchases, pawnshops with interest rates, terms, rental fees, security measures for obligations as prescribed by law (hereinafter referred to as other participating organizations).

4. Borrower is an organization or individual granted credit by credit institutions, foreign bank branches or provided leasing services, deferred payment purchases, installment purchases, pawnshops with interest rates, terms, rental fees, security measures for obligations as prescribed by law by other participating organizations.

5. A credit information company is a business entity established and operating under the Enterprise Law to engage in the provision of credit information services as prescribed in this Decree. The company name must include the term "credit information".

Information infrastructure is a set of hardware, software, databases, network systems, and security systems to establish, transmit, collect, process, store, and exchange digital information serving one or more technical activities and credit information service provision activities of credit information companies.

Identification information is identification information of borrowers as prescribed by the Government regarding the confidentiality and provision of customer information by credit institutions, foreign bank branches.

Negative information about borrowers is credit information on bad debts, breach of payment obligations, violation of laws, being sued, indicted, and other unfavorable information affecting the borrower's evaluation results.

Credit information product is a report, publication, or other form containing credit information created by credit information companies based on collected credit information to be provided to users.

User is an organization or individual within the scope of receiving credit information products who has agreed with credit information companies on the provision of credit information products.

Article 4. Principles of Operation in Providing Credit Information Services

1. A credit information company may only carry out activities to provide credit information services after being granted a Certificate by the State Bank.

2. The provision of credit information services must comply with legal regulations, ensuring honesty, objectivity, and not affecting the rights and legitimate interests of related organizations and individuals.

3. Agreements and commitments in the provision of credit information services stipulated in this Decree must be established in writing or in another form having equivalent legal value to a written document as prescribed by law.

4. A credit information company may only collect credit information of borrowers from participating organizations when the borrower agrees to allow such organization to provide credit information to the credit information company according to Appendix I issued together with this Decree.

5. Principles for providing credit information products:

a) A credit information company shall provide credit information products in accordance with Article 21 of this Decree;

b) A credit information company may only provide credit information products containing identifiable information of borrowers to other participating organizations when the borrower agrees to allow such organization to use the credit information product provided by the credit information company according to Appendix II issued together with this Decree, except in cases where the borrower has agreed to such organization under Clause 4 of this Article;

c) A credit information company shall not provide credit information products containing identifiable information of borrowers to other organizations or individuals as specified in point d, Clause 1 of Article 21 of this Decree.

Article 5. Principles for Using Credit Information Products

1. Credit information products shall be used for purposes specified in Clause 1 of Article 21 of this Decree. The user shall not modify the credit information product and shall bear responsibility for their own decisions when using the credit information product.

2. The user shall not provide credit information products to third parties, except for the objects specified in point b, Clause 1 of Article 21 of this Decree.

3. Copying and internal use of credit information products by the user organization must be consistent with the agreements made with the credit information company.

Article 6. Prohibited Acts in Providing Credit Information Services

1. Illegally collecting and providing information within the scope and list of state secrets.

2. Intentionally distorting the content of credit information, affecting the legitimate rights and interests of related organizations and individuals.

3. Exchanging credit information, providing credit information products to incorrect recipients, for incorrect purposes, or illegally.

4. Taking advantage of credit information service provision for personal gain, infringing upon the interests of the state, the rights and legitimate interests of organizations and individuals.

5. Obstructing lawful activities of organizations and individuals in collecting and using credit information.

Article 7. Reporting on Activities in Providing Credit Information Services

1. A credit information company shall submit reports in writing directly to the State Bank or through postal services; or electronically to the State Bank the following reports:

a) Financial statements as prescribed by law;

b) Reports on operational status according to Appendix III issued together with this Decree;

c) Reports on major technical incidents concerning information infrastructure (such as hardware and software malfunctions, attacks on databases, network systems, security systems, and other incidents causing abnormal operation of the credit information company's information infrastructure) according to Appendix IV issued together with this Decree;

d) Reports on changes including: business management personnel, supervisory board members; number of participating organizations; agreements on procedures for collecting, processing, storing, and providing credit information between the credit information company and participating organizations; information infrastructure according to Appendix IV issued together with this Decree.

2. Time limit for submitting reports:

a) Reports as specified in point a, Clause 1 of this Article shall be submitted periodically monthly, quarterly, and annually. In which, monthly reports shall be submitted before the 10th day of the month immediately following the reporting month; quarterly reports shall be submitted before the 20th day of the month immediately following the reporting quarter; annual financial statements without audit shall be submitted within 30 days from the end of the fiscal year; annual audited financial statements shall be submitted within 90 days from the end of the fiscal year;

b) Reports as specified in point b, Clause 1 of this Article shall be submitted periodically quarterly and annually. In which, quarterly reports shall be submitted before the 20th day of the month immediately following the reporting quarter; annual operational situation reports shall be submitted within 30 days from the end of the reporting year;

c) Reports as specified in point c, Clause 1 of this Article must be reported immediately on the day the incident occurs. If the incident occurs during a regular holiday or public holiday, it shall be reported on the first working day after the holiday;

d) Reports as specified in point d, Clause 1 of this Article shall be submitted no later than seven working days from the date of change.

3. Time for finalizing report data:

a) For reports as specified in points a and b, Clause 1 of this Article, the time for finalizing report data shall be determined according to each reporting period corresponding to the accounting period as prescribed by the Accounting Law;

b) For reports as specified in points c and d, Clause 1 of this Article, the time for finalizing report data shall be determined according to the specific content required to be reported when they occur or when there is a change.

Article 8. Competence of State Management Agencies

1. The State Bank shall implement state management over the provision of credit information services in accordance with the Law on the State Bank of Vietnam, including:

a) Drafting and submitting to competent state agencies for promulgation, or promulgating within its competence, legal normative documents regarding the provision of credit information services;

b) Issuing, reissuing, changing the content, and revoking the Certificate of Credit Information Companies;

c) Inspecting and supervising the provision of credit information services by credit information companies.

2. Ministries, ministerial-level agencies, People's Committees of provinces and centrally governed cities shall implement state management over credit information companies in accordance with the Law on Enterprises and related laws.

Chapter II
CONDITIONS, PROCEDURES, AND FORMALITIES FOR ISSUING, REISSUING, CHANGING CONTENT, AND REVOKING THE CERTIFICATE

NỘI DUNG VÀ THU HỒI GIẤY CHỨNG NHẬN

Article 9. Conditions for Issuing the Certificate

1. Having an information infrastructure system meeting the following minimum requirements:

a) Having at least two data transmission lines, each from a different service provider;

b) Having an information infrastructure capable of integrating and connecting with the information systems of participating organizations;

c) Having servers located in Vietnam, software solutions, and technical measures capable of providing credit information services to at least five million borrowers;

d) Having security plans ensuring information safety;

đ) Having disaster recovery plans ensuring that credit information service activities will not be interrupted for more than four working hours;

2. Having a minimum charter capital of thirty billion Vietnamese dong.

3. Having business managers and members of the Supervisory Board meeting the following requirements:

a) Business managers and members of the Supervisory Board must not be individuals who have been convicted of serious crimes or higher, or individuals who have been convicted of property-related offenses without having their criminal records expunged; business managers and members of the Supervisory Board of credit information companies whose Certificates have been revoked (except in cases where the Certificate was revoked according to points d, đ, and e of Clause 1, Article 14 of this Decree);

b) The Chairman of the Board of Directors, the Chairman of the Board of Members, and the Company Chairman must hold a bachelor’s degree or higher and have at least three years of work experience in finance, banking, accounting, auditing, or information technology;

c) Members of the Board of Directors, the Board of Members, and general partners must hold a bachelor’s degree or higher, with at least fifty percent of members having at least three years of work experience in finance, banking, accounting, auditing, or information technology;

d) The General Director (Director) and Deputy General Director (Deputy Director) must hold a bachelor’s degree or higher and have at least two years of managerial experience in enterprises operating in the fields of finance, banking, accounting, auditing, or information technology;

đ) Members of the Supervisory Board must hold a bachelor’s degree or higher and have at least two years of work experience in finance, banking, accounting, auditing, or information technology.

4. Having a business plan ensuring that the company does not engage in other businesses outside of providing credit information services.

5. Having a minimum of fifteen participating organizations as credit institutions, foreign bank branches (excluding policy banks, cooperative banks, people's credit funds, and microfinance organizations). Participating organizations must not have agreements to provide credit information with other credit information companies.

6. Having an agreement on the provision of information and credit information products between the credit information company and participating organizations, which must include at least the following contents:

a) Content and scope of credit information provided;

b) Time, location, method of providing, transmitting, processing, and storing credit information and products;

c) Principles, scope, and purpose of using credit information products;

d) Obligation to notify and agree with borrowers about the use of their credit information;

đ) Responsibilities of all parties in correcting errors during the updating, transmission, processing, storage, exploitation, and use of credit information;

e) Responsibilities of all parties in reviewing, reconciling, inspecting, and maintaining the quality of credit information;

g) Responsibilities and cooperation of all parties when resolving errors in borrower credit information;

h) Handling violations and resolving disputes;

i) Effectiveness of the agreement and unilateral termination of the agreement;

k) Other rights and obligations of all parties during the collection, processing, storage, and provision of credit information.

Article 10. Principles for the preparation and submission of files

1. The file must be prepared in one set in Vietnamese. Foreign language components of the file must be legalized according to Vietnamese law (except where exempted from legalization under Vietnamese law on legalization) and translated into Vietnamese. Translations from foreign languages into Vietnamese must be notarized or certified by the translator's signature in accordance with Vietnamese law.

3. The file shall be submitted at the single-window department of the State Bank or through postal service to the State Bank.

Article 11. Procedures and formalities for issuing the Certificate

1. The credit information company prepares a file requesting the State Bank to issue the Certificate, including:

a) An application form for the Certificate as per Appendix V attached to this Decree;

b) The Articles of Association of the enterprise (a copy);

c) Contract with the service provider enterprise (a copy);

d) Documentation regarding the registered capital (a copy), including: Proof corresponding to the form of contribution: Confirmation by a commercial bank or foreign bank branch regarding the account balance for cash; valuation results by a professional valuation organization for other contributed assets in compliance with the Law on Prices, the Law on Enterprises, and related laws; or the most recent audited financial report relative to the time of filing;

đ) A list and curriculum vitae of each individual who is a manager of the enterprise or member of the Supervisory Board as per Appendix VI attached to this Decree;

e) Criminal record sheet (a copy) of each individual who is a manager of the enterprise or member of the Supervisory Board:

For individuals with Vietnamese citizenship: The criminal record sheet issued by the authority managing the criminal record database, which must include complete information about criminal history (including expunged and non-expunged criminal records) and information about prohibition from holding positions, establishing, and managing enterprises and cooperatives;

For individuals without Vietnamese citizenship: The criminal record sheet or equivalent document (containing complete information about criminal history; information about prohibition from holding positions, establishing, and managing enterprises and cooperatives) must be issued by the competent authority of Vietnam or the competent authority of a foreign country in accordance with regulations. In cases where the criminal record sheet or equivalent document issued by a foreign authority does not contain information about prohibition from holding positions, establishing, and managing enterprises and cooperatives, the credit information company must provide an explanatory document regarding the absence of such information from the issuing authority of the criminal record sheet or equivalent document and commit to bearing responsibility under the law for the fact that the individual does not fall within the prohibited categories under Vietnamese law;

The criminal record sheet or equivalent document must be issued by the competent authority within six months from the date the credit information company submits the application file;

g) Business plan as per Appendix VII attached to this Decree;

h) Commitment letter for providing credit information from participating organizations as per Appendix VIII attached to this Decree;

i) Agreement on the provision of information and credit information products between the credit information company and participating organizations (a copy).

2. Within five working days from the date of receipt of the application file from the credit information company, the State Bank sends a letter to the credit information company requesting additional documentation if the application file is incomplete or invalid as stipulated in Clause 1 of this Article.

3. Within thirty working days from the date of receipt of a complete and valid file, the State Bank issues the Certificate to the credit information company as per Appendix IX attached to this Decree. If the Certificate is not issued, the State Bank sends a reply letter specifying the reasons.

Article 12. Procedure for Reissuing the Certificate

1. The credit information company requests the State Bank to reissue the Certificate in the following cases:

a) The Certificate is lost;

b) The Certificate is torn or damaged otherwise.

2. The application dossier for reissuing the Certificate includes:

a) An application form for reissuing the Certificate according to Appendix X issued together with this Decree;

b) The torn or damaged Certificate (except in the case of loss).

3. Within three working days from the date of receiving the application dossier of the credit information company, the State Bank shall send a letter to the credit information company requesting to supplement the dossier if the application dossier is incomplete or not in compliance with the provisions of Clause 2 of this Article.

4. Within ten working days from the date of receiving the complete and valid dossier of the credit information company, the State Bank shall examine and reissue the Certificate according to Appendix IX issued together with this Decree.

Article 13. Procedure for Amending the Content of the Certificate

1. The credit information company requests the State Bank to amend the content of the Certificate in the following cases:

a) The name of the credit information company;

b) The business registration certificate;

c) Charter capital;

d) Location of the main office.

2. Within seven working days from the date the Decision revoking the License becomes effective:

2. When changing one or more items on the Certificate, the credit information company shall prepare an application dossier for amending the content of the Certificate to be sent to the State Bank, including:

a) An application form for amending the content of the Certificate according to Appendix X issued together with this Decree;

b) The resolution of the Shareholders' Meeting, Board of Directors, or Management Board, or Chairman of the company regarding the amendment of the content of the Certificate (original);

c) Documents and papers proving the continued maintenance of sufficient conditions for operation when the proposed amendment to the content of the Certificate relates to the operating conditions of the credit information company and is consistent with each condition stipulated in this Decree (copy).

3. Within five working days from the date of receiving the application dossier of the credit information company, the State Bank shall send a letter to the credit information company requesting to supplement the dossier if the application dossier is incomplete or not in compliance with the provisions of Clause 2 of this Article.

4. Within fifteen working days from the date of receiving the complete and valid dossier, the State Bank shall issue a Decision to amend the content of the Certificate according to Appendix XI issued together with this Decree (the Decision to amend the content of the Certificate is an inseparable part of the Certificate); in case of refusal, the State Bank shall send a reply letter stating the reasons.

Article 14. Procedure for Revoking the Certificate

1. The credit information company shall be revoked the Certificate in the following cases:

a) Fraud or forgery of documents proving the fulfillment of conditions for obtaining the Certificate in the application dossier for issuing the Certificate;

b) Serious violation of any prohibited acts stipulated in Article 6 of this Decree;

c) Failure to maintain the conditions stipulated in Article 9 of this Decree after implementing the remediation plan as prescribed in Point b, Clause 2 of this Article;

d) Failure to commence operations providing credit information services within twelve months from the date of issuance of the Certificate;

đ) The credit information company implements dissolution in accordance with the law;

e) The credit information company is divided, merged, or consolidated in accordance with Clause 4, Article 15 of this Decree.

2. The State Bank shall revoke the Certificate as follows:

a) In the case where the credit information company violates the provisions of Point a and Point b, Clause 1 of this Article, the State Bank shall decide to revoke the Certificate of the credit information company based on the inspection and supervision conclusion of the State Bank or the proposal of another competent authority;

b) In the case where the credit information company violates the provisions of Point c, Clause 1 of this Article, the State Bank shall require the credit information company to develop a remediation plan for violations, submit it to the State Bank, and implement it within a maximum period of twelve months from the date the State Bank requires the credit information company to develop the remediation plan.

The State Bank shall decide to revoke the Certificate of the credit information company when assessing that the credit information company has not remedied the violations within one month from the end of the remediation period according to the remediation plan;

c) In the case where the credit information company violates the provisions of Point d, Clause 1 of this Article, the State Bank shall decide to revoke the Certificate of the credit information company within fifteen working days from the end date of the commencement of operations as stipulated in Clause 1, Article 16 of this Decree;

d) In the case where the credit information company implements dissolution in accordance with the provisions of Point d, Clause 1 of this Article, the credit information company shall notify the State Bank in writing about the implementation of the dissolution of the enterprise and attach relevant documents within seven working days from the date of passing the dissolution decision or the date of receiving the business registration certificate revocation decision or the dissolution decision of the Court as stipulated in the Enterprise Law.

The State Bank shall decide to revoke the Certificate of the credit information company within five working days from the date of receipt of the notification letter and relevant documents of the credit information company;

đ) In the case where the credit information company implements restructuring in accordance with the provisions of Point e, Clause 1 of this Article, the credit information company shall notify the State Bank in writing about the implementation of the restructuring of the enterprise and attach relevant documents within seven working days from the date of passing the division resolution or merger agreement or consolidation agreement as stipulated in the Enterprise Law.

The State Bank decides to revoke the Certificate of the credit information company within seven working days from the date of receipt of the notification document and related documents of the credit information company.

3. The State Bank issues a Decision to revoke the Certificate of the credit information company according to Appendix XII issued together with this Decree. The credit information company must immediately cease its activities in providing credit information services and return the Certificate within seven working days from the date the Decision to revoke the Certificate takes effect.

4. Within ten working days from the date the Decision to revoke the Certificate takes effect, the credit information company whose Certificate has been revoked shall develop a plan for handling retained credit information at the credit information company in one of the following forms:

a) Transfer to another credit information company upon agreement of participating organizations and without violating agreements with borrowing customers having credit information. The credit information company shall send a notice of the transfer result to the State Bank within five working days from the end of the transfer process;

b) Transfer to the State Bank upon agreement of participating organizations and without violating agreements with borrowing customers having credit information. The management and use of transferred credit information shall be carried out in accordance with the laws on credit information activities of the State Bank;

c) Organize the destruction itself and bear responsibility under the law for the completeness, security, and confidentiality of destroyed credit information, and send a notice of the destruction result to the State Bank within five working days from the end of the destruction process.

Article 15. Reorganization of Credit Information Companies

1. Credit information companies shall reorganize in accordance with the Law on Enterprises and relevant laws.

2. New credit information companies resulting from business division; credit information companies that have been split, merged shall request the State Bank to issue a Certificate in accordance with Article 11 of this Decree.

3. Credit information companies changing their legal form; credit information companies that have been split, taken over shall request the State Bank to amend the contents of the Certificate in accordance with Article 13 of this Decree.

4. Credit information companies that have been divided, merged, or taken over shall have their Certificates revoked by the State Bank in accordance with Article 14 of this Decree.

Article 16. Commencement of Operations and Public Announcement of Information on Issuance, Amendment, and Revocation of Certificates

1. Within a maximum period of twelve months from the date of issuance of the Certificate, the credit information company must commence operations in providing credit information services and submit a notice to the State Bank about the commencement of operations within five working days from the date the credit information company starts operations.

2. The credit information company shall publicize information related to the issuance, amendment of the Certificate on the State Bank's communication means, the credit information company's communication means, and at least three consecutive issues or seven working days on a central or local newspaper where the main office of the credit information company is located, or on a Vietnamese online newspaper, from the date the State Bank issues or approves the amendment of the Certificate.

3. The State Bank shall notify the registration authority where the credit information company's main office is located if it does not issue a Certificate meeting the conditions for providing credit information services as stipulated in Clause 3, Article 11 of this Decree.

4. The State Bank shall announce the Decision to revoke the Certificate of the credit information company on its communication means and send it to the registration authority where the credit information company's main office is located.

Chapter III
ACTIVITIES OF PROVIDING CREDIT INFORMATION SERVICES

Article 17. Internal regulations

1. Based on the provisions of this Decree and relevant laws, the credit information company shall establish and promulgate internal regulations for its credit information service provision activities, ensuring control mechanisms linked to each process and emergency handling plans.

2. Internal regulations on the provision of credit information services by the credit information company shall include at least the following contents:

a) Regulations on the provision of credit information services, including measures to verify the reasonableness of collected credit information as stipulated in Point d, Clause 1, Article 18 and regulations on the right to refuse to provide credit information products to users as stipulated in Clause 2, Article 21 of this Decree;

b) Regulations on information security and technology safety in the provision of credit information services, including at least contents on physical and installation environment safety assurance; operation management and information exchange; access management; third-party IT service management (if any); information security incident management; continuous system operation assurance; internal audit and reporting systems;

c) Regulations on hierarchical authorization, responsibilities of individual managers, board members for supervisory management in the provision of credit information services, especially regulations on management and supervision related to information security and confidentiality;

d) Regulations on correcting errors in credit information, including at least contents on procedures, responsibilities of individuals and departments in error correction and retention of related documentation for error correction.

đ) Provisions on the handling of credit information in the event that the credit information company has its Certificate revoked in accordance with Clause 4, Article 14 of this Decree, including at least the contents regarding the form of handling; implementation procedures (including methods of notification and obtaining consent from participating organizations); responsibilities of departments and individuals in organizing and implementing; monitoring and securing credit information during the implementation process.

3. Internal regulations must be reviewed and evaluated every six months or at any time about their appropriateness, compliance with legal provisions, and revised or supplemented if necessary.

Article 18. Collection of Credit Information

1. A credit information company collects credit information from:

a) Participating organizations according to commitments and agreements to provide credit information;

b) Other credit information companies pursuant to agreements with credit information companies;

c) State agencies as prescribed by law;

d) Other lawful sources as prescribed by law.

2. Collected credit information includes:

a) Customer identification information of borrowers and related parties of borrowers as prescribed by current laws;

b) Information on credit history, leasing, deferred payment purchases, installment payments, pawn transactions;

c) Information on repayment history, amounts due or not yet due, repayment deadlines, credit limits, loan classification, debt sale, off-balance sheet commitments, and customer scoring results;

d) Information on collateral for the fulfillment of borrower repayment obligations;

đ) Other relevant information ensuring no violation of borrowers' legal rights, excluding information on borrowers classified as state secrets.

3. The credit information specified in Clause 2 of this Article does not include information on the use of risk reserves to address risks associated with credit extensions by financial institutions and foreign bank branches.

Article 19. Handling of Credit Information

1. Based on collected and stored credit information sources, credit information companies analyze, evaluate, and compile information to create credit information products.

2. The process of checking, classifying, and updating credit information must ensure that it does not distort the nature or content of the credit information.

3. Negative information about borrowers can only be used to create credit information products for a maximum period of five years from the end date of such negative information, except where otherwise provided by law.

Article 20. Storage of Credit Information

1. Credit information must be securely stored and protected against potential accidents, disasters, and unauthorized access from outside.

2. Credit information must be retained for a minimum of five years from the date the credit information company collects it.

Article 21. Provision of Credit Information Products

1. A credit information company provides credit information products to the following users:

a) Participating organizations to serve the needs of finding borrowers, evaluating borrowers, and other lawful purposes as prescribed by law;

b) Borrowers who are provided credit information products about themselves for lawful purposes of the borrowers;

c) Other credit information companies to collect credit information under Article 18 of this Decree for credit information service operations;

d) State management agencies authorized by law to serve state management purposes as prescribed by law;

đ) Other organizations and individuals to serve lawful purposes as prescribed by law.

2. After reaching an agreement with the users specified in Clause 1 of this Article, the credit information company may refuse to provide credit information products and notify the user in writing of the reasons for refusal (with relevant documents attached if any) at least twenty working days before ceasing to provide the credit information product if the user is found to have violated the signed agreement, this Decree, and related laws.

Article 22. Correction of Errors in Customer Borrower Credit Information

1. The credit information company shall implement error corrections in the following cases:

a) The credit information company discovers errors in credit information and implements error correction according to its internal regulations;

b) An organization participating in the discovery of errors in credit information sends a written request for error correction to the credit information company along with related documents. The credit information company must provide a written notification of the results of implementing the error correction via direct delivery; or through postal service; or through other electronic means to the participating organization within a maximum of five working days from the date of receipt of the participating organization's written request for error correction;

c) A borrower customer discovers errors in credit information and sends a written request for error correction to the credit information company or participating organization along with related documents. The credit information company or participating organization must notify the borrower customer about the processing process and the results of implementing the error correction via direct delivery; or through postal service; or through other electronic means to the borrower customer within a maximum of five working days from the end of the correction period as stipulated in Clause 2 of this Article.

2. The credit information company shall implement error correction based on the borrower customer's request as follows:

a) In the case where the error arises from the credit information company's information processing, the credit information company shall implement error correction within a maximum of five working days from the date of receipt of the borrower customer's written request for error correction;

b) In the case where the credit information company determines that the error originates from information collected at the participating organization, the credit information company shall notify the borrower customer about the processing process (including the source of the error) within a maximum of five working days and cooperate with the participating organization to correct the error within a maximum of ten working days from the date of receipt of the borrower customer's written request for error correction.

3. In the event that the borrower customer does not receive a response document within the time frame specified in Clause 2 of this Article or disagrees with the content of the response document from the credit information company, the borrower customer has the right to request mediation or proceed with arbitration or court procedures as prescribed by law.

Chapter IV
RIGHTS AND OBLIGATIONS OF ORGANIZATIONS AND INDIVIDUALS

Article 23. Rights and Obligations of Users

Implement rights and obligations agreed upon with the credit information company as stipulated in this Decree and relevant laws.

Article 24. Rights and Obligations of Credit Information Companies

1. Rights of credit information companies

a) Exchange credit information with other credit information companies in accordance with this Decree and relevant laws;

b) Enter into contracts with organizations and individuals regarding the collection, provision of credit information, and charging fees for credit information products as stipulated in this Decree and relevant laws.

2. Obligations of credit information companies

a) Ensure principles, conditions, and contents of credit information service operations throughout the operation period;

b) Advise users on the principles of using credit information products;

c) Cooperate with participating organizations to detect and handle errors in credit information; resolve error correction requests from borrower customers;

d) Publicly display pricing for credit information products in accordance with the Price Law and relevant laws;

e) Publish information in accordance with the Enterprise Law, this Decree, and relevant laws.

3. Perform other rights and obligations as agreed with organizations and individuals, as stipulated in this Decree and relevant laws.

Article 25. Rights and obligations of participating organizations

1. The right to use credit information products from credit information companies in accordance with this Decree and relevant laws.

2. Obligations of participating organizations

a) To provide complete, accurate, and timely credit information to credit information companies as agreed upon with such companies;

b) To cooperate with credit information companies to detect and handle errors in collected, stored, and provided credit information; to resolve adjustment documents for customer credit information errors.

3. To perform other rights and obligations as agreed upon with credit information companies, as stipulated in this Decree and relevant laws.

Article 26. Rights and obligations of borrowing customers

1. Rights of borrowing customers

a) To be provided free of charge at least once a year with their own credit information by credit information companies (if requested);

b) To request credit information companies to review and adjust the content of their own credit information if errors are discovered and to be informed of the results of such adjustments (if any) by participating organizations.

2. Borrowing customers have the obligation to provide complete and truthful credit information about themselves to related organizations and individuals during the process of handling adjustment requests regarding their own credit information errors.

3. To perform other rights and obligations as prescribed in this Decree and relevant laws.

Chapter V
IMPLEMENTING PROVISIONS

Article 27. Transitional Provisions

1. From the date this Decree takes effect, the provisions of Clause 4, Point b Clause 5, Article 4 of this Decree shall not have retroactive effect on the collection of credit information and the provision of credit information products by credit information companies.

2. Within two months from the date this Decree takes effect, credit information companies established and operating before the effective date of this Decree must submit reports to the State Bank of Vietnam on meeting the conditions for obtaining the Certificate of Eligibility as prescribed in Article 9 of this Decree and commit to bear legal responsibility for the contents of the report.

a) In case of compliance with the conditions, credit information companies may continue to operate credit information service supply activities according to the Certificate of Eligibility for Credit Information Activities issued by the State Bank of Vietnam and as stipulated in this Decree.

b) In case of non-compliance with one or more conditions, credit information companies must report plans to meet the conditions within a maximum period of 24 months from the date this Decree takes effect.

Credit information companies that meet the conditions prescribed in Article 9 of this Decree after the completion of the plan period may continue to operate credit information service supply activities according to the Certificate of Eligibility for Credit Information Activities issued by the State Bank of Vietnam and as stipulated in this Decree.

Credit information companies that fail to meet the conditions prescribed in Article 9 of this Decree after the completion of the plan period, the State Bank of Vietnam will revoke the Certificate of the credit information company in accordance with Clause 3, Article 14 of this Decree.

3. Within six months from the date this Decree takes effect, credit information companies established and operating before the effective date of this Decree must issue internal regulations in accordance with Article 17 of this Decree and submit these internal regulations to the State Bank of Vietnam.

4. For agreements and commitments signed before the effective date of this Decree, credit information companies may continue to implement them until the expiration date of the agreements and commitments and cannot extend them. Any amendments or supplements to these agreements and commitments can only be made if the amended or supplemented content complies with the provisions of this Decree and relevant laws.

Article 28. Effective Date

1. This Decree takes effect from August 15, 2021.

2. Repeal Article 4 of Decree No. 16/2019/NĐ-CP dated February 1, 2019 of the Government on amending and supplementing certain articles of decrees regulating business conditions under the management of the State Bank of Vietnam.

3. Decree No. 10/2010/NĐ-CP dated February 12, 2010 of the Government on credit information activities; Decree No. 57/2016/NĐ-CP dated July 1, 2016 of the Government amending and supplementing Article 7 of Decree No. 10/2010/NĐ-CP dated February 12, 2010 of the Government on credit information activities shall cease to be effective from the date this Decree takes effect.

Article 29. Implementation Organization

Ministers, Heads of ministerial-level agencies, Heads of government-affiliated agencies; Chairmen of provincial People's Committees, centrally governed cities; Chairmen of Boards of Directors, Chairmen of Boards of Members, and General Directors (Directors) of credit institutions, foreign bank branches; Chairmen of Boards of Directors, Chairmen of Boards of Members, Chairmen of companies, and General Directors (Directors) of credit information companies and related organizations and individuals are responsible for implementing this Decree.